VulnerabilityModified
CVE-2014-3024
Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 through 7.5.0.6 and Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk allows remote…
MEDIUM 6.0EPSS 0.80%
Does this matter?
Lower severity and a low EPSS score (0.80%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.12 and 7.5 through 7.5.0.6 and Maximo Asset Management 7.5.0 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk allows remote authenticated users to hijack the authentication of arbitrary users.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 0.80% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- ibm/smartcloud control desk · ibm/maximo asset management
- Source
- psirt@us.ibm.com
References
- http://secunia.com/advisories/60408
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV56643
- http://www-01.ibm.com/support/docview.wss?uid=swg21679918Vendor Advisory
- http://www.securitytracker.com/id/1030781
- https://exchange.xforce.ibmcloud.com/vulnerabilities/93063
- http://secunia.com/advisories/60408
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV56643
- http://www-01.ibm.com/support/docview.wss?uid=swg21679918Vendor Advisory
- http://www.securitytracker.com/id/1030781
- https://exchange.xforce.ibmcloud.com/vulnerabilities/93063
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.